← ACARA Digital Technologies Years 9–10

Reading a vulnerability report

A public vulnerability report with a unique ID that names the affected software and versions, explains how the flaw is exploited, gives a severity score and links to a fix.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 65

Understanding Reading a vulnerability report in ACARA Digital Technologies Years 9–10

What it does: A report lists the version range that contains the flaw. You compare it with your installed version to see if you are at risk. A report points to a patched version or a temporary workaround. Following it is how a reader fixes the vulnerability. A CVE ID has the form CVE, then the year, then a number, such as CVE-2021-44228. It gives each vulnerability one unique name. Severity scores run from 0 to 10. Scores of 9.0 and above are rated critical, so they should be fixed first. The CVE ID only names the flaw. The patch or workaround link tells you how to fix it, such as updating to a newer version.

Common mistakes: A CVE identifier is written CVE-YEAR-NUMBER. The year comes first, so the ID should be CVE-2021-44228. Severity scores run from 0 to 10. A score of 75 is impossible, so it should be 7.5.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Reading a vulnerability report to a class →

This module's key terms are also in a printable crossword (Modules 810–827) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which is a correctly formatted CVE identifier?
CVE-2021-44228CVE-VERY-BAD-1
Matches
My app is version 2.20, and the report says versions 2.0 to 2.14 are affected, so I must be at risk.
↓
The version number was not compared properly. Version 2.20 is outside the affected range, so this app is not listed as vulnerable.
Applying
Meanings
Term
CVE
Meaning
A public vulnerability report with a unique ID that names the affected software and versions, explains how the flaw is exploited, gives a severity score and links to a fix.
Practice
ID: CVE-2025-01234
Testing
Gaps
ID: -2024-31337
Check Answer
Spots
1Product: Apache Log4j
2ID: CVE-44228-2021

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Rhinoceros' badge — Thick-Skinned Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which is a correctly formatted CVE identifier?
A. CVE-VERY-BAD-1
B. CVE-2021-44228 ✓
A CVE ID has the form CVE, then the year, then a number, such as CVE-2021-44228. It gives each vulnerability one unique name.
2. A report lists 'Affected versions: 2.0 to 2.14.1'. You run version 2.10. What should you conclude?
A. Your version is affected and you should look for a fix ✓
B. You are safe because 2.10 is a small number
Version 2.10 falls inside the range 2.0 to 2.14.1, so your software has the flaw. Always compare your version to the affected range.
3. A vulnerability has a severity score of 9.8 out of 10. How should you treat it?
A. Critical: fix it as a high priority ✓
B. Low risk: it can wait until next year
Severity scores run from 0 to 10. Scores of 9.0 and above are rated critical, so they should be fixed first.
4. Which part of a vulnerability report tells you how to fix the problem?
A. The CVE identifier
B. The patch or workaround link ✓
The CVE ID only names the flaw. The patch or workaround link tells you how to fix it, such as updating to a newer version.
5. No patch is available yet, but the report suggests turning off a risky feature. What is this called?
A. A workaround ✓
B. A patch
A workaround reduces the risk until a proper fix is ready. A patch is an update that actually fixes the flaw in the code.

Match the Pairs

CVE-2021-44228 → The unique CVE identifier that names one specific vulnerability so everyone can look up the same report
CVSS score: 9.8 (Critical) → The severity score that rates how dangerous the vulnerability is, on a scale from 0 to 10
The affected versions line tells you whether the software you run is vulnerable → Affected versions: 2.0 to 2.14.1
The fix section links to a patch or a workaround that removes or reduces the risk → Fix: update to version 2.15.0
My app is version 2.20, and the report says versions 2.0 to 2.14 are affected, so I must be at risk. → The version number was not compared properly. Version 2.20 is outside the affected range, so this app is not listed as vulnerable.
The severity score is 2.1 out of 10, so this is the most urgent flaw and I should fix it first. → A score of 2.1 is low severity. High scores near 10 mean the most urgent and dangerous flaws.

Key Term

CVE
A public vulnerability report with a unique ID that names the affected software and versions, explains how the flaw is exploited, gives a severity score and links to a fix.

Fill in the Blanks

1. ID: CVE-2024-31337
Hint: Type the three-letter prefix used for public vulnerability IDs.
2. Severity: 9.8 (Critical)
Hint: Type the rating word for a score between 9.0 and 10.
3. Affected versions: ShopApp 2.0 to 2.4
Hint: Type the field name that lists which releases have the flaw.
4. Fix: upgrade to 2.5 or apply the patch
Hint: Type the word for a software update that repairs a flaw.
5. Severity score: 9.8 out of 10
Hint: Type the highest score on the scale.

Spot the Error

Question 1
A Product: Apache Log4j
B ID: CVE-44228-2021
C Affected: 2.0 to 2.14.1
D Fix: upgrade to 2.15.0
Line B — A CVE identifier is written CVE-YEAR-NUMBER. The year comes first, so the ID should be CVE-2021-44228.
Question 2
A ID: CVE-2014-0160
B Software: OpenSSL 1.0.1
C Severity: 75 (High)
D Fix: upgrade to 1.0.1g
Line C — Severity scores run from 0 to 10. A score of 75 is impossible, so it should be 7.5.
Question 3
A ID: CVE-2017-0144
B Severity: 9.8 (Low)
C Affected: Windows SMBv1
D Fix: install patch MS17-010
Line B — A score of 9.8 is in the 9.0-10.0 band, which is Critical. It should not be labelled Low.
Question 4
A CVE-2023-1234
B Affected: ShopApp 3.1 to 3.4
C Fixed in: 3.2
D Advice: update to 3.5 or later
Line C — The fix must be a version newer than the affected range (3.1 to 3.4). Version 3.2 is still vulnerable, so it should say 3.5.
Question 5
A CVE-2022-5555
B Affected: ChatBox 1.0 to 1.3
C Flaw: unsafe file upload
D Workaround: allow all uploads
Line D — A workaround reduces the risk until a patch is installed. The flaw is in file upload, so the workaround should disable uploads, not allow them.

Student with a class code? Join your class →